unkin-agent
70dd1bd775
Mail needs one routing hub between the edge gateways, Stalwart and the lab: inbound to Stalwart over LMTP, outbound to the gateways, all of it through rspamd. - add a 2-replica postfix StatefulSet `mail-in.main.unkin.net` (50Gi spool per pod, node spread, PDB) - serve port 25 with the LE `*.main.unkin.net` wildcard, reflected into `mail` - gateways (TLS, XFORWARD) relay to relay_domains with LMTP recipient verification; lab and pods relay anywhere - pass all mail through the rspamd milter, tempfailing when it is down - limit port 25 via NetworkPolicy to gateways, lab and `mail.unkin.net/smarthost-client=true` pods - relay outbound via mta1/mta2.edge.unkin.net with verified TLS; add ClusterIP + LB 198.18.200.16 Requires #539 merged. Reviewed-on: #541 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
43 lines
1.7 KiB
CFEngine3
43 lines
1.7 KiB
CFEngine3
compatibility_level = 3.5
|
|
myhostname = mail-in.main.unkin.net
|
|
myorigin = unkin.net
|
|
mydestination =
|
|
alias_maps =
|
|
local_recipient_maps =
|
|
inet_interfaces = all
|
|
inet_protocols = ipv4
|
|
maillog_file = /dev/stdout
|
|
message_size_limit = 52428800
|
|
|
|
# Relay-anywhere clients; gateways must stay out.
|
|
mynetworks = cidr:/etc/postfix/mynetworks.cidr
|
|
|
|
relay_domains = texthash:/etc/postfix/relay_domains
|
|
# Default minus relay_domains: subdomains are not delivered and would loop back out via the gateways.
|
|
parent_domain_matches_subdomains = debug_peer_list,fast_flush_domains,mynetworks,permit_mx_backup_networks,qmqpd_authorized_clients,smtpd_access_maps
|
|
transport_maps = texthash:/etc/postfix/transport
|
|
relayhost = [mta1.edge.unkin.net]:25
|
|
smtp_fallback_relay = [mta2.edge.unkin.net]:25
|
|
smtp_tls_policy_maps = texthash:/etc/postfix/tls_policy
|
|
smtp_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt
|
|
smtpd_client_restrictions = permit_mynetworks, check_client_access cidr:/etc/postfix/gateways.cidr, reject
|
|
smtpd_relay_restrictions = permit_mynetworks, reject_unauth_destination
|
|
smtpd_recipient_restrictions = permit_mynetworks, reject_unverified_recipient
|
|
unverified_recipient_reject_code = 550
|
|
unverified_recipient_tempfail_action = defer_if_permit
|
|
address_verify_negative_refresh_time = 5m
|
|
address_verify_negative_expire_time = 1h
|
|
address_verify_positive_refresh_time = 1h
|
|
address_verify_positive_expire_time = 1d
|
|
|
|
milter_default_action = tempfail
|
|
smtpd_milters = inet:rspamd.mail.svc:11332
|
|
smtpd_authorized_xforward_hosts = cidr:/etc/postfix/gateways.cidr
|
|
|
|
smtpd_tls_security_level = may
|
|
smtpd_tls_cert_file = /etc/postfix/tls/tls.crt
|
|
smtpd_tls_key_file = /etc/postfix/tls/tls.key
|
|
smtpd_tls_received_header = yes
|
|
smtp_tls_security_level = may
|
|
lmtp_tls_security_level = none
|